| Age | Commit message (Collapse) | Author |
|---|
|
Keycloak has always been heavyweight and cumbersome. Kanidm is meant to
be an all-in-one Rust identity provider instead.
$ sudo kanidmd recover-account idm_admin
$ kanidm login --name idm_admin
$ kanidm group account-policy credential-type-minimum idm_all_persons any
$ kanidm person create joe Joe
$ kanidm person credential update joe
$ kanidm system oauth2 create oauth2-proxy 'OAuth2 Proxy' https://op.mou.fo
$ kanidm system oauth2 update-scope-map oauth2-proxy idm_all_persons openid profile email
$ kanidm system oauth2 show-basic-secret oauth2-proxy
Passkeys don't work with KeePassXC on Firefox. They might work with
Chrome or BitWarden. We disable TOTP for password authentication.
Kanidm itself has considered and rejected forward auth support per
https://github.com/kanidm/kanidm/issues/2774
With this arrangement session cookies are about 2k. While large these
should fit within the default nginx buffers.
Dex can be used as a simple identity provider, although it is more
designed to facilitate app authentication. It can be configured to have
a workable configuration with no persistent state and only staticClients
and staticPasswords for resource servers and users.
Vouch Proxy is comparable with oauth2-proxy. Both assume the user has an
e-mail which we don't use. However oauth2-proxy seems to have better
workarounds and is somewhat more actively maintained. Vouch Proxy also
lacks a NixOS module.
https://discourse.nixos.org/t/configuring-vouch-proxy-or-oauth2-proxy-nginx-nix/19337/2
https://github.com/vouch/vouch-proxy/issues/309
|
|
DISABLE_REGISTRATION needs to be set after the initial administrator
account is manually registered.
Considered the Forgejo community fork, but it doesn't seem to have
attracted very much of the developer community. Despite concerns about
copyright claims, Gitea does not have a CLA; it is MIT licensed. Still
considering even lighter weight options that may be easier to
programmatically control (just an HTTP server that speaks the smart
protocol?).
For managing groups of repositories, can use labels or organizations.
Neither seem particularly convenient.
Gitea defaults to public repositories.
|
|
|
|
Based on https://github.com/nathan-gs/nix-conf/blob/main/lib/ha.nix
(which goes further in using the module system; see
https://nathan.gs/2023/12/09/adding-helper-functions-to-nixos/ )
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- Populate OAuth tokens using justajoedoe.
- Use binary cache build of Nitter.
|
|
|
|
|
|
To resolve database collation version mismatches ("The database was
created using collation version 2.38, but the operating system provides
version 2.39."):
$ sudo -u postgres psql
> \c hass
> REINDEX DATABASE hass;
> ALTER DATABASE hass REFRESH COLLATION VERSION;
[ Repeat for all databases (except special database template0) ]
|
|
|
|
|
|
|
|
|
|
Also fixes missing component errors.
|
|
mailutils (but not sendmail) addresses from the unqualified hostname
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The intention is to separate user-managed data, like backups and file
shares. Still need to move syncthing over. An implication is /srv will
probably not participate in restic backups but be replicated in some
other way.
|
|
Initial run trimmed nearly the entire volume. May be quite important
since Nix churns through storage.
|
|
Clarifies that they are not managed by a distribution package.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Contravenes guidance to avoid edits to hardware-configuration.nix
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
